CVE-2022-31700

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

VMware Workspace ONE Access and Identity Manager contain an authenticated remote code execution vulnerability. VMware has evaluated the severity of this issue to be in the Important severity range with a maximum CVSSv3 base score of 7.2.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	VMware Workspace ONE Access (Access), VMware Identity Manager (vIDM)	VMware Workspace ONE Access (Multiple Versions)

References

https://www.vmware.com/security/advisories/VMSA-2022-0032.htmlVendor Advisory
https://www.vmware.com/security/advisories/VMSA-2022-0032.htmlVendor Advisory

Timeline

Published: Dec 14, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-317015.3VMware Workspace ONE Access and Identity Manager contain a broken authentication vulnerability. VMware has evaluated the severity of this is CVE-2022-317029.8vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network acce CVE-2022-317037.5The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operati CVE-2022-317049.8The vRealize Log Insight contains a broken access control vulnerability. An unauthenticated malicious actor can remotely inject code into se CVE-2022-317058.2VMware ESXi, Workstation, and Fusion contain a heap out-of-bounds write vulnerability in the USB 2.0 controller (EHCI). A malicious actor wi CVE-2022-317069.8The vRealize Log Insight contains a Directory Traversal Vulnerability. An unauthenticated, malicious actor can inject files into the operati CVE-2022-317077.2vRealize Operations (vROps) contains a privilege escalation vulnerability. VMware has evaluated the severity of this issue to be in the Impo CVE-2022-317084.9vRealize Operations (vROps) contains a broken access control vulnerability. VMware has evaluated the severity of this issue to be in the Mod CVE-2022-31717.5A parsing issue with binary data in protobuf-java core and lite versions prior to 3.21.7, 3.20.3, 3.19.6 and 3.16.3 can lead to a denial of CVE-2022-317107.5vRealize Log Insight contains a deserialization vulnerability. An unauthenticated malicious actor can remotely trigger the deserialization o CVE-2022-317115.3VMware vRealize Log Insight contains an Information Disclosure Vulnerability. A malicious actor can remotely collect sensitive session and a CVE-2022-31728.2A security issue was discovered in kube-apiserver that allows an aggregated API server to redirect client traffic to any URL. This could